Description
A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.
Published: 2026-10-07
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The flaw is a code injection vulnerability in the upgrade script of Movable Type that permits an unauthenticated attacker to run arbitrary Perl code or execute arbitrary SQL queries. This is a classic instance of the CWE‑94 weakness, which can give an attacker control over the server’s file system or database, enabling full system compromise or data loss.

Affected Systems

All publicly listed editions of Movable Type—Movable Type, Movable Type Cloud Edition, Movable Type Premium, and Movable Type Premium Cloud Edition—are affected. Since no specific version numbers or patch information are disclosed, any deployed instance of these products should be presumed vulnerable until a patch is applied.

Risk and Exploitability

The CVSS score of 9.3 indicates a high severity, while the EPSS score is not available and the vulnerability is not yet listed in CISA’s KEV catalog. The weakness requires no authentication and can be triggered by an unauthenticated web client that initiates the upgrade process, making it highly actionable for attackers.

Generated by OpenCVE AI on October 7, 2026 at 12:37 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a patched version of Movable Type that fixes the code injection flaw.
  • If a patch cannot be applied immediately, block unauthenticated web access to the upgrade script by disabling the /upgrade path or configuring the web server to deny all requests to it.
  • Reduce the privilege level of the database account used by Movable Type to limit the impact of any injected SQL statements.

Generated by OpenCVE AI on October 7, 2026 at 12:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 09 Oct 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Six Apart
Six Apart movable Type
Six Apart movable Type Cloud Edition
Six Apart movable Type Premium
Six Apart movable Type Premium Cloud Edition
Vendors & Products Six Apart
Six Apart movable Type
Six Apart movable Type Cloud Edition
Six Apart movable Type Premium
Six Apart movable Type Premium Cloud Edition

Wed, 07 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Code Injection via Upgrade Script in Movable Type

Wed, 07 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
Description A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.
Weaknesses CWE-94
References
Metrics cvssV3_0

{'score': 9.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Six Apart Movable Type Movable Type Cloud Edition Movable Type Premium Movable Type Premium Cloud Edition
cve-icon MITRE

Status: PUBLISHED

Assigner: jpcert

Published:

Updated: 2026-10-07T17:47:24.024Z

Reserved: 2026-10-02T04:23:48.464Z

Link: CVE-2026-96408

cve-icon Vulnrichment

Updated: 2026-10-07T17:47:18.495Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-07T11:17:20.620

Modified: 2026-10-07T18:17:32.210

Link: CVE-2026-96408

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T08:16:20Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')